Improve wallet passphrase strength guidance

[0xpantera]

Context

Deckard's keystore uses Argon2id with strong production parameters, but offline vault security still depends heavily on the user's passphrase. The current create/import flow enforces a minimum length of 8 characters, which is a floor, not meaningful strength guidance.

Goal

Improve the wallet create/import UX so users get clear passphrase quality feedback before sealing a real vault.

Acceptance criteria

• Keep the existing minimum-length rejection, but add stronger user-facing guidance or a strength check for new/imported wallet passphrases.
• Prefer plain language over crypto jargon.
• Do not log, persist, or send passphrases outside the existing unlock/seal flow.
• Do not add network-backed strength checks.
• Tests cover the validation/helper logic if a helper is introduced.
• cargo fmt --all --check, just check, and cargo test --workspace pass.

Notes

Argon2id slows offline guessing, but it does not make weak passphrases safe.

[hellno]

Shipped. Verified on main: crates/deckard-app/src/onboarding.rs has a live passphrase strength meter — passphrase_strength() plus a PassBand lattice (TooShort / Weak / Fair / Good / Strong) driving a single source-of-truth word + colour (danger → amber → green), shown on the create flow.

Matches the acceptance criteria: keeps the min-length floor, adds plain-language strength feedback, length-dominant, no network-backed check, no logging/persisting the passphrase. Landed with the UX foundation work (#120).

Closing as done.